What is the CVSS score of CVE-2026-44733?

CVE-2026-44733 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-44733?

Yes, a patch is available for CVE-2026-44733. Update the affected software to the latest version immediately.

OpenProject CVE-2026-44733

EUVD-2026-39861 MEDIUM

Unverified Password Change (CWE-620)

2026-06-26 GitHub_M

Authentication Bypass Openproject Opf

5.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

6.8 MEDIUM

Session prerequisite justifies AC:H and PR:L; permanent credential change warrants I:H over the original I:L; no availability impact applies.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 26, 2026 - 21:02 EUVD

Analysis Generated

Jun 26, 2026 - 20:38 vuln.today

DescriptionCVE.org

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirements. A password validation flaw in the change password behavior allows attackers to change a user's password only with an active session takeover. This vulnerability is fixed in 17.3.2 and 17.4.0.

AnalysisAI

Password validation bypass in OpenProject's REST API allows an attacker who has already seized a valid user session to change that account's password without supplying the current password, exploiting CWE-620 (Unverified Password Change) via a crafted PATCH request to /api/v3/users/me. Affected versions are all OpenProject releases prior to 17.3.2 and 17.4.0 (CPE cpe:2.3:a:opf:openproject:*:*:*:*:*:*:*:*). No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, when chained with a session-takeover primitive, it converts transient access into persistent account control.

Technical ContextAI

OpenProject is an open-source, web-based project management platform whose REST API exposes a PATCH /api/v3/users/me endpoint for self-service profile and credential updates. CWE-620 (Unverified Password Change) describes failures in the server-side logic that is supposed to confirm the user's current/old password before accepting a new one - a foundational control that prevents sessions from being weaponized for credential hijacking. In this case the business logic governing that endpoint omits or mishandles the old-password verification step, allowing the field to be omitted or bypassed entirely. The CPE cpe:2.3:a:opf:openproject:*:*:*:*:*:*:*:* covers all versions of the opf/openproject package up to (but not including) 17.3.2 on the stable branch and 17.4.0 on the release branch.

RemediationAI

Upgrade OpenProject to version 17.3.2 or 17.4.0, both confirmed as fixed releases by the vendor advisory at https://github.com/opf/openproject/security/advisories/GHSA-px7f-cj9f-7m4m. If immediate patching is not feasible, deploy a WAF or reverse-proxy rule to block or require additional authentication on PATCH requests to the /api/v3/users/me endpoint - note this will also block legitimate self-service profile updates, potentially requiring users to contact admins for password changes during the interim. Enforce short session lifetimes and enable anomaly alerting on unexpected password change API calls (especially those lacking old-password fields) to detect exploitation attempts. Restrict API access to trusted network segments where architectural constraints permit, which reduces but does not eliminate risk given the session-dependent attack path.